<html>
<head><meta charset="utf-8"><title>Can&#x27;t tell if it&#x27;s a miri false positive · t-lang/wg-unsafe-code-guidelines · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/index.html">t-lang/wg-unsafe-code-guidelines</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html">Can&#x27;t tell if it&#x27;s a miri false positive</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="179809317"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179809317" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179809317">(Nov 04 2019 at 06:54)</a>:</h4>
<p>Hello all, Ralf particularly for this one, I have a crate called bytemuck for casting slices and such. <a href="https://github.com/Lokathor/bytemuck" target="_blank" title="https://github.com/Lokathor/bytemuck">https://github.com/Lokathor/bytemuck</a></p>
<p>I pulled it out of a large lib a month or so ago and just remembered to move the tests as well this weekend. I figured i'd run it through miri too, but then I got a test failure!</p>
<div class="codehilite"><pre><span></span>D:\dev\bytemuck&gt;cargo miri test
   Compiling bytemuck v0.1.1-alpha.0 (D:\dev\bytemuck)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

    Finished test [unoptimized + debuginfo] target(s) in 0.88s
   Compiling bytemuck v0.1.1-alpha.0 (D:\dev\bytemuck)

running 3 tests
test test_try_cast_slice ... ok
error[E0080]: Miri evaluation error: trying to reborrow for Unique, but parent tag &lt;untagged&gt; does
not have an appropriate item in the borrow stack
    --&gt; C:\Users\Daniel\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\src\libcore\slice\mod.rs:5257:5
     |
5257 |     &amp;mut *ptr::slice_from_raw_parts_mut(data, len)
     |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Miri evaluation error: trying to reborrow for Unique, but parent tag &lt;untagged&gt; does not have an appropriate item in the borrow stack
     |
     = note: inside call to `std::slice::from_raw_parts_mut::&lt;u8&gt;` at D:\dev\bytemuck\src\lib.rs:232:17
note: inside call to `bytemuck::try_cast_slice_mut::&lt;u32, u8&gt;` at tests\cast_slice_tests.rs:47:30
    --&gt; tests\cast_slice_tests.rs:47:30
</pre></div>


<p>Honestly I can't really tell if this is actually a problem or if miri is being weird or what. I get the same error even when I to use identically sized type (eg: <code>&amp;mut [u32]</code> to <code>&amp;mut [f32]</code>), but I <em>don't</em> get the error with a straight up <code>core::mem::transmute</code>.</p>



<a name="179818497"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179818497" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179818497">(Nov 04 2019 at 09:47)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> a minimal working example in the playground that reproduces the issue would help</p>



<a name="179843474"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179843474" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179843474">(Nov 04 2019 at 15:34)</a>:</h4>
<p>uh, sure, <a href="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=b28a15e3d99616b03caafdd794550946" target="_blank" title="https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=b28a15e3d99616b03caafdd794550946">https://play.rust-lang.org/?version=nightly&amp;mode=debug&amp;edition=2018&amp;gist=b28a15e3d99616b03caafdd794550946</a></p>



<a name="179873290"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179873290" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179873290">(Nov 04 2019 at 20:33)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> the problem is that you are using <code>.as_ptr</code> instead of <code>.as_mut_ptr</code></p>



<a name="179873336"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179873336" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179873336">(Nov 04 2019 at 20:33)</a>:</h4>
<p>oh my gosh i should have seen that one</p>



<a name="179873429"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179873429" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179873429">(Nov 04 2019 at 20:34)</a>:</h4>
<p>and if I'd used the new <code>cast</code> method i would have had the compiler detect it too</p>



<a name="179873431"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179873431" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179873431">(Nov 04 2019 at 20:34)</a>:</h4>
<p>_I think_ that ends up creating <code>&amp;mut [B]</code> -&gt; <code>&amp;[B]</code> -&gt; <code>*const B</code> -&gt; <code>*mut A</code> -&gt; .. -&gt; <code>&amp;mut [A]</code> chain, which creates a mut reference from a shared one</p>



<a name="179873448"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179873448" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179873448">(Nov 04 2019 at 20:34)</a>:</h4>
<p>yeah</p>



<a name="179873515"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179873515" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179873515">(Nov 04 2019 at 20:35)</a>:</h4>
<p>I don't know if this is a false positive or not</p>



<a name="179873630"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179873630" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179873630">(Nov 04 2019 at 20:36)</a>:</h4>
<p>but at least with <code>as_mut_ptr</code> it works<br>
i've seen quite a lot of code that does this, and that code isn't wrong, in the sense that doing that isn't really "wrong" (that shared reference is still unique)</p>



<a name="179873648"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179873648" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179873648">(Nov 04 2019 at 20:36)</a>:</h4>
<p>but in miri that <code>&amp;self</code> invalidates the Unique in the borrow stack</p>



<a name="179885593"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179885593" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179885593">(Nov 04 2019 at 22:50)</a>:</h4>
<p>I'll fix it later today and yank the old version, better safe than sorry I suppose</p>



<a name="179896198"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179896198" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179896198">(Nov 05 2019 at 02:14)</a>:</h4>
<p>Fixed and released!</p>



<a name="179914126"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179914126" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179914126">(Nov 05 2019 at 09:22)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> if you dont @mention me I don't get pinged ;)</p>



<a name="179914198"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179914198" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179914198">(Nov 05 2019 at 09:23)</a>:</h4>
<p>oh I figured you just sense the smell of fresh UB every morning</p>



<a name="179914209"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179914209" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179914209">(Nov 05 2019 at 09:23)</a>:</h4>
<blockquote>
<p>_I think_ that ends up creating <code>&amp;mut [B]</code> -&gt; <code>&amp;[B]</code> -&gt; <code>*const B</code> -&gt; <code>*mut A</code> -&gt; .. -&gt; <code>&amp;mut [A]</code> chain, which creates a mut reference from a shared one</p>
</blockquote>
<p>if that is indeed the chain then its definitely a true positive. this is considered mutation of shared data, a big no-go.</p>



<a name="179914252"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179914252" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179914252">(Nov 05 2019 at 09:24)</a>:</h4>
<blockquote>
<p>oh I figured you just sense the smell of fresh UB every morning</p>
</blockquote>
<p>sure, but I don't know where the smell comes from so I don't know where to go to fix it. I got used to ignoring it. ;)</p>



<a name="179914290"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179914290" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179914290">(Nov 05 2019 at 09:24)</a>:</h4>
<p>i switched to 1.38 and the cast method to avoid this possibly in the future</p>



<a name="179914298"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179914298" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179914298">(Nov 05 2019 at 09:24)</a>:</h4>
<p>cast method?</p>



<a name="179914309"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179914309" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179914309">(Nov 05 2019 at 09:24)</a>:</h4>
<p>pointers have a cast method now</p>



<a name="179914331"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179914331" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179914331">(Nov 05 2019 at 09:24)</a>:</h4>
<p>ah, that keeps mutability the same but changes the type?</p>



<a name="179914336"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179914336" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179914336">(Nov 05 2019 at 09:24)</a>:</h4>
<p>yes</p>



<a name="179914397"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179914397" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179914397">(Nov 05 2019 at 09:25)</a>:</h4>
<p>maybe we should have a clippy lint against mutability-changing raw ptr casts... <span class="user-mention" data-user-id="127617">@Shnatsel</span> has done a lot of safety clippy work recently I hear, does this seem like an interesting case?</p>



<a name="179914419"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179914419" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179914419">(Nov 05 2019 at 09:25)</a>:</h4>
<p>I have seen at least 2 or 3 cases over the last few weeks for a const-to-mut raw ptr cast being the give-away for mutation of shared data</p>



<a name="179914475"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179914475" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179914475">(Nov 05 2019 at 09:26)</a>:</h4>
<p><a href="https://github.com/rust-lang/rust-clippy/issues/4771" target="_blank" title="https://github.com/rust-lang/rust-clippy/issues/4771">https://github.com/rust-lang/rust-clippy/issues/4771</a></p>



<a name="179916459"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179916459" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179916459">(Nov 05 2019 at 09:54)</a>:</h4>
<blockquote>
<p>this is considered mutation of shared data, a big no-go.</p>
</blockquote>
<p>In a <code>&amp;mut T -&gt; &amp;T -&gt; &amp;mut T</code> chain, as long as the <code>&amp;T</code> is not "duplicated", it is still unique, but the current model does not account for that.</p>



<a name="179916513"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179916513" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179916513">(Nov 05 2019 at 09:56)</a>:</h4>
<p>(which is a fair thing to do, and that means that this code is wrong according to that model)</p>



<a name="179916553"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179916553" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179916553">(Nov 05 2019 at 09:56)</a>:</h4>
<blockquote>
<blockquote>
<p>this is considered mutation of shared data, a big no-go.</p>
</blockquote>
<p>In a <code>&amp;mut T -&gt; &amp;T -&gt; &amp;mut T</code> chain, as long as the <code>&amp;T</code> is not "duplicated", it is still unique, but the current model does not account for that.</p>
</blockquote>
<p>it's not the <code>&amp;mut</code> that is causing UB here, it's the <code>&amp;T</code></p>



<a name="179916558"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179916558" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179916558">(Nov 05 2019 at 09:56)</a>:</h4>
<p>and <code>&amp;T</code> comes with a promise of immutability</p>



<a name="179916581"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179916581" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179916581">(Nov 05 2019 at 09:56)</a>:</h4>
<p>so, the program is UB because of a violation of immutability.<br>
there is indeed no violation of uniqueness here, but that's besides the point.</p>



<a name="179916616"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179916616" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179916616">(Nov 05 2019 at 09:57)</a>:</h4>
<p>I thought the cause of the UB was the <code>&amp;T -&gt; &amp;mut T</code> "cast"</p>



<a name="179918286"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179918286" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179918286">(Nov 05 2019 at 10:22)</a>:</h4>
<p>it is. creating a mutable ref to some memory is considered mutating said memory. <code>&amp;T</code> and pointers derived from it dont allow mutation.</p>



<a name="179918339"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179918339" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179918339">(Nov 05 2019 at 10:23)</a>:</h4>
<p>(and here someone might actually write to that memory later, so even if creating a mutable ref wouldnt be the issue, doing the write later certainly would)</p>



<a name="179920487"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179920487" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179920487">(Nov 05 2019 at 10:54)</a>:</h4>
<p>to allow this the model would need to allow, e.g., writing through a <code>&amp;mut T</code> derived from a <code>&amp;T</code> as long as it is unique and the memory behind it is writeable</p>



<a name="179928102"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179928102" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179928102">(Nov 05 2019 at 12:47)</a>:</h4>
<p>uh, no, the model doesnt want to allow this</p>



<a name="179928110"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179928110" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179928110">(Nov 05 2019 at 12:47)</a>:</h4>
<p>allowing this would kill all the useful optimizations we have for <code>&amp;T</code></p>



<a name="179928163"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179928163" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179928163">(Nov 05 2019 at 12:48)</a>:</h4>
<p>you must be able to pass an <code>&amp;T</code> to unknown code and know for sure that it will not be mutated</p>



<a name="179928185"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179928185" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179928185">(Nov 05 2019 at 12:48)</a>:</h4>
<p>this is not a model bug. it is an explicit design goal of the rust memory model to make this code UB. and that has been the case from the start, hence all this talking about shared references being read-only and <code>UnsafeCell</code> to make the exception explicit to the compiler.</p>



<a name="179942334"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179942334" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179942334">(Nov 05 2019 at 15:26)</a>:</h4>
<p>in this case no unknown code is involved though</p>



<a name="179967908"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179967908" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179967908">(Nov 05 2019 at 19:31)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> yeah, mutability-changing raw ptr casts sound like a thing we'd like to lint against. <br>
Actually, why not have <code>rustc</code> itself lint against that, as well as other obviously gross misuse such as the eternally beautiful <code>MaybeUninit::uninit().assume_init()</code> one-liner?</p>



<a name="179968055"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179968055" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179968055">(Nov 05 2019 at 19:32)</a>:</h4>
<p>Clippy is great, but kind of optional, and I want some tool to yell at people unconditionally whenever they try anything like that.</p>



<a name="179969489"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179969489" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179969489">(Nov 05 2019 at 19:47)</a>:</h4>
<blockquote>
<p>in this case no unknown code is involved though</p>
</blockquote>
<p>I dont see what that has to do with anything. the R-AM has no notion of "unknown code" that would affect execution behavior.</p>



<a name="179969519"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179969519" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179969519">(Nov 05 2019 at 19:47)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> such lints could still start in clippy and then be moved if they prove useful</p>



<a name="179969548"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179969548" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179969548">(Nov 05 2019 at 19:47)</a>:</h4>
<p>I dont know if we have a strategy for lints aimed at unsafe code in rustc itself, but having a pool of useful ones in clippy would help ;)</p>



<a name="179969598"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179969598" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179969598">(Nov 05 2019 at 19:48)</a>:</h4>
<p>also <code>MaybeUninit::uninit().assume_init()</code> isnt always wrong...</p>



<a name="179969630"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179969630" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179969630">(Nov 05 2019 at 19:48)</a>:</h4>
<p>we do these days lint against it if it is used at a "bad" type... well, we will once <a href="https://github.com/rust-lang/rust/pull/66044" target="_blank" title="https://github.com/rust-lang/rust/pull/66044">https://github.com/rust-lang/rust/pull/66044</a> lands</p>



<a name="179972405"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179972405" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179972405">(Nov 05 2019 at 20:17)</a>:</h4>
<p>Opened Clippy lint request: <a href="https://github.com/rust-lang/rust-clippy/issues/4774" target="_blank" title="https://github.com/rust-lang/rust-clippy/issues/4774">https://github.com/rust-lang/rust-clippy/issues/4774</a><br>
And a compiler warning request: <a href="https://github.com/rust-lang/rust/issues/66136" target="_blank" title="https://github.com/rust-lang/rust/issues/66136">https://github.com/rust-lang/rust/issues/66136</a></p>



<a name="179974861"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179974861" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179974861">(Nov 05 2019 at 20:39)</a>:</h4>
<p>maybe in the future dont open two issues with the same text at the same time though^^</p>



<a name="179974871"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179974871" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179974871">(Nov 05 2019 at 20:39)</a>:</h4>
<p>that leads to lots of duplicate discussion</p>



<a name="179975482"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/179975482" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#179975482">(Nov 05 2019 at 20:45)</a>:</h4>
<p>Yeah good point. Sorry about that.</p>



<a name="180028123"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/180028123" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#180028123">(Nov 06 2019 at 12:48)</a>:</h4>
<blockquote>
<p>I dont see what that has to do with anything. the R-AM has no notion of "unknown code" that would affect execution behavior.</p>
</blockquote>
<p>You brought unknown code up:  "you must be able to pass an &amp;T to unknown code and know for sure that it will not be mutated" . I don't know what that has to do with anything either, my example has no unknown code:</p>



<a name="180028336"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/180028336" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#180028336">(Nov 06 2019 at 12:50)</a>:</h4>
<div class="codehilite"><pre><span></span><span class="k">fn</span> <span class="nf">foo</span><span class="p">()</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="k">mut</span><span class="w"> </span><span class="n">x</span><span class="w"> </span>: <span class="kt">i32</span><span class="o">=</span><span class="w"> </span><span class="mi">0</span><span class="p">;</span><span class="w"></span>
<span class="w">    </span><span class="kd">let</span><span class="w"> </span><span class="n">y</span>: <span class="kp">&amp;</span><span class="nc">mut</span><span class="w"> </span><span class="kt">i32</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="k">unsafe</span><span class="w"> </span><span class="p">{</span><span class="w"> </span><span class="n">transmute</span><span class="p">(</span><span class="o">&amp;</span><span class="n">x</span><span class="p">)</span><span class="w"> </span><span class="p">};</span><span class="w"></span>
<span class="w">    </span><span class="o">*</span><span class="n">y</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="mi">42</span><span class="p">;</span><span class="w"></span>
<span class="p">}</span><span class="w"></span>
</pre></div>



<a name="180028539"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/180028539" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#180028539">(Nov 06 2019 at 12:53)</a>:</h4>
<p>So I don't know why this example needs to be UB "because of unknown code".</p>



<a name="180028574"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/180028574" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#180028574">(Nov 06 2019 at 12:54)</a>:</h4>
<p>AFAICT it is not doing anything that cannot be made defined behavior. The only valid argument I see to make this undefined is that it simplifies the design.</p>



<a name="180044448"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/180044448" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#180044448">(Nov 06 2019 at 15:41)</a>:</h4>
<p>The rules of the R-AM need to work well for <em>all</em> programs. The rule change you proposed makes them not work well for all programs (greatly diminishes optimization potential when unknown code is involved, which is the norm). In theory you could try to fix this by making a <em>different</em> proposal which somehow makes your specific program not-UB but leaves programs where "unknown code is involved" also UB, but that is not what you did so far and there are several reasons to expect such attempts to fail (e.g. as Ralf said, there's no notion of "unknown code" in R-AM terms).</p>



<a name="180061934"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/180061934" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#180061934">(Nov 06 2019 at 18:25)</a>:</h4>
<p>I'm not proposing any rules. I said that I see _a lot_ of code like the one @lokathor wrote, both in the wild and in the standard library, and that a lot of people expect <code>&amp;mut T as &amp;T as &amp;mut T</code> to be a nop, instead of instant UB. That UB does not buy us anything in such code optimization wise, and at least with the current backends and optimizations, bugs due to it only show up on miri.</p>



<a name="180062524"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/180062524" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#180062524">(Nov 06 2019 at 18:31)</a>:</h4>
<p>Its hard to explain to a user that wrote such code why it is UB, what can go wrong, and why they need to fix it, when in these particular situations absolutely nothing can go wrong.</p>



<a name="180062766"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/180062766" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#180062766">(Nov 06 2019 at 18:33)</a>:</h4>
<p>I agree that the current rules buy us optimization in some other code, but they do not buy us any optimizations in examples like the above, which apparently are quiet common.</p>



<a name="180066899"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/180066899" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#180066899">(Nov 06 2019 at 19:14)</a>:</h4>
<blockquote>
<p>to allow this the model would need to allow, e.g., writing through a <code>&amp;mut T</code> derived from a <code>&amp;T</code> as long as it is unique and the memory behind it is writeable</p>
</blockquote>
<p>this is what I was referring to</p>



<a name="180067825"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/180067825" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Hanna Kruppe <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#180067825">(Nov 06 2019 at 19:25)</a>:</h4>
<p>In any case, the informed opinion that there's most likely no decent (e.g., comprehensible, implementable) rule set that simultaneously (1) does not have the UB you're complaining about in those specific programs, and (2) does not lose optimization power on other programs, stands and will almost certainly continue to stand unless you (or someone else, hypothetically) convincingly challenges it. It's all good and well to point out a downside of the plan of record but you can't expect that downside to be avoided if nobody can offer a better alternative.</p>



<a name="180147323"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/180147323" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> gnzlbg <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#180147323">(Nov 07 2019 at 16:12)</a>:</h4>
<p>I don't have an alternative that satisfies all other constraints</p>



<a name="180905844"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/180905844" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#180905844">(Nov 16 2019 at 09:57)</a>:</h4>
<blockquote>
<p>That UB does not buy us anything in such code optimization wise</p>
</blockquote>
<p>you mean UB for that <em>specific</em> snippet of code, right? because what makes this UB is the general rule not to write through shared references and their descendants. and <em>that UB</em> certainly buys us <em>a lot</em> in terms of optimizations.</p>
<p>this is like pointing at <code>*(0usize as *mut i32) = 0</code> and saying "well that UB doesn't buy us anything". that's true in a very literal interpretation of the statement, but that's also failing to take into account why this is UB in the first place.</p>



<a name="180905851"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/180905851" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#180905851">(Nov 16 2019 at 09:58)</a>:</h4>
<blockquote>
<p>a lot of people expect &amp;mut T as &amp;T as &amp;mut T to be a nop</p>
</blockquote>
<p>a lot of people also expect uninit memory to be "just some random bytes", or they expect <code>inttoptr(ptrtoint(ptr))</code> to be a NOP. turns out a lot of people are just wrong about some basic facts of how Rust, and C and C++, work. we should try to educate them as best we can.</p>



<a name="183378127"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/183378127" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#183378127">(Dec 13 2019 at 16:56)</a>:</h4>
<p><span class="user-mention" data-user-id="120791">@RalfJ</span> I am trying to figure out what exactly to lint against in the Clippy issue about <code>_.as_ptr() as *mut _</code> now that a core Clippy contributor is taking up implementation, but I feel I am in over my head. Could you step in and clarify which patterns should be linted against?<br>
<a href="https://github.com/rust-lang/rust-clippy/issues/4774" target="_blank" title="https://github.com/rust-lang/rust-clippy/issues/4774">https://github.com/rust-lang/rust-clippy/issues/4774</a></p>



<a name="183447060"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/183447060" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#183447060">(Dec 14 2019 at 16:07)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> there were a lot of responses in that thread, are there still open questions?<br>
<a href="https://github.com/rust-lang/rust-clippy/issues/4774#issuecomment-565651216" target="_blank" title="https://github.com/rust-lang/rust-clippy/issues/4774#issuecomment-565651216">https://github.com/rust-lang/rust-clippy/issues/4774#issuecomment-565651216</a> is accurate.</p>



<a name="183447473"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can%27t%20tell%20if%20it%27s%20a%20miri%20false%20positive/near/183447473" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/136281-t-lang/wg-unsafe-code-guidelines/topic/Can&#x27;t.20tell.20if.20it&#x27;s.20a.20miri.20false.20positive.html#183447473">(Dec 14 2019 at 16:16)</a>:</h4>
<p>If the summary is accurate no further input is needed. Thanks!</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>